Yeah I thought regular web traffic on HTTPS would look innocuous too, but I guess they can inspect how the data is structured and easily see if it belongs to a certain protocol (like Nostr) that way